AP Cybersecurity Drill 29: Device Security Analysis Source Set

Question 1. Reading the firewall rules top to bottom, what happens to a remote-desktop request to port 3389 that comes from outside the IT subnet?

• A) Rule 1 matches it because every port-3389 request is treated as coming from the IT subnet
• B) Rule 3 matches first and denies it before any allow rule is reached
• C) No rule matches it, so the firewall denies it by leaving it unhandled
• D) Rule 2 matches it and allows the connection from any source ✓

Explanation: Choice D is correct. Rule 1 matches only the IT subnet, so an outside request falls through to rule 2, which allows port 3389 from any source; with first-match evaluation, rule 2 fires before the final deny. Choice A is incorrect because rule 1's source is the IT subnet, not every source. Choice B is incorrect because rule 3 is reached only if no earlier rule matches, and rule 2 matches first. Choice C is incorrect because rule 2 does match this request, so it is not left unhandled.

Question 2. Because rule 2 allows port 3389 from any source, which change brings the firewall in line with the device policy?

• A) Remove rule 2 so that only the IT subnet may reach port 3389 and everything else is denied ✓
• B) Move rule 3 above rule 1 so that the broad deny is evaluated before either of the allow rules
• C) Change rule 1 to allow port 3389 from any source so that it matches how rule 2 already behaves
• D) Add a fourth rule allowing port 3389 from any source, placed just after the final deny rule

Explanation: Choice A is correct. The policy permits remote desktop only from the IT subnet; removing the broad rule 2 leaves rule 1 (allow IT subnet) followed by the default deny, which is what the policy requires. Choice B is incorrect because putting the deny first would block the IT subnet too, breaking legitimate access. Choice C is incorrect because widening rule 1 to any source repeats the same violation. Choice D is incorrect because a rule placed after the final deny is never reached, so it changes nothing.

Question 3. Compare Source 3's permissions to the policy for /reports. Which statement is accurate?

• A) The permissions match the policy, since others are correctly limited to read access
• B) The permissions are stricter than the policy, because the group cannot read the file
• C) The permissions violate the policy, because the group can write when only the owner should ✓
• D) The permissions cannot be compared, because the policy does not mention the group at all

Explanation: Choice C is correct. The policy says only the owner may write to /reports, but the listing grants the group write as well, so the group has more access than the policy allows. Choice A is incorrect because, although others are read-only as required, the group's write access still breaks the policy. Choice B is incorrect because the group can in fact read and write, not less than the policy. Choice D is incorrect because the policy clearly addresses who may write, which applies to the group's access.

Question 4. Across all three sources, which finding is the most direct policy violation affecting the integrity of quarterly.txt and should be addressed first?

• A) Remote desktop is reachable from any source on port 3389 because of the broad allow rule
• B) The group can write to quarterly.txt even though only the owner should have write access ✓
• C) The default administrator account may still be enabled with a known weak password
• D) The permission listing uses notation that some staff members may find hard to read

Explanation: Choice B is correct. The policy states that only the owner may write to files in /reports, but the listing grants the group write access too, which directly violates the policy and lets the group alter the report file's contents. Choice A is a real and serious finding, but it concerns remote access to the device rather than write access to the report file, so it is not the most direct violation affecting that file's integrity. Choice C is incorrect because the sources state the policy requirement for the administrator account but do not show that the account currently violates it. Choice D is incorrect because notation that is hard to read is a usability concern, not a policy violation.

Question 5. The team wants quarterly.txt to allow the owner to read and write, the group to read only, and others none. Which chmod setting achieves that?

• A) chmod 666 quarterly.txt, giving read and write to the owner, the group, and others alike
• B) chmod 640 quarterly.txt, giving the owner read and write, the group read, and others none ✓
• C) chmod 600 quarterly.txt, giving the owner read and write and removing all group and other access
• D) chmod 644 quarterly.txt, giving the owner read and write, the group read, and others read

Explanation: Choice B is correct. In octal, 6 is read plus write, 4 is read, and 0 is no access, so 640 gives the owner read and write, the group read only, and others nothing, exactly as required. Choice A is incorrect because 666 grants write to the group and others, the opposite of the goal. Choice C is incorrect because 600 removes the group's read access, which should be allowed. Choice D is incorrect because 644 also lets others read the file, but others should have no access.